CertBase ("we", "us", "our") is committed to protecting your personal data. This policy explains what we collect, why we collect it, and your rights under UK GDPR.

CertBase is operated by Prysm Innovations LTD. For the data described in this policy about our own customers, website visitors and enquirers, we are the data controller, contactable at hello@certbase.co.uk.

Our customers also use CertBase to record data about their clients, sites and contacts, for example tenant or site-contact details on a certificate. For that data our customer is the controller and we act as their processor, handling it only on their instructions and under our terms of service. Questions about it are best directed to the business that carried out your inspection.

1. Data we collect

Account and organisation data

Name and email address when you create an account
Organisation name and any details you enter during onboarding
Billing name and address collected by our payment processor, Stripe

Enquiries

Name, email address, company and message when you use the contact form on our website
If you enquire on behalf of an organisation, its approximate size and the number of sites it manages

Usage data

PAT test records, asset registers, locations, and certificates you create within the app
Engineer assignments and team member details you add
Customer and portal user records you create

Technical data

IP address and browser/device type for security logging
Error and performance logs to maintain service reliability

2. How we use your data

To provide the service: storing and syncing your test records and certificates (legal basis: contract performance)
To process payments: passing billing details to Stripe to manage your subscription (legal basis: contract performance)
To respond to enquiries: replying to messages sent through our contact form and following up on demo requests (legal basis: legitimate interests, or steps taken at your request before entering into a contract)
To send transactional emails: account confirmation, password resets, subscription receipts (legal basis: contract performance)
To improve the product: analysing aggregated usage patterns to fix bugs and prioritise features (legal basis: legitimate interests)
To comply with legal obligations: retaining billing records as required by law (legal basis: legal obligation)

3. Sub-processors

We share data with the following third-party processors, each bound by appropriate data processing agreements. Our primary data store is in the UK.

Supabase: database, authentication, file storage and server functions. Data stored in the UK (London region). Supabase Privacy Policy
Stripe: payment processing. Data processed in the US under EU-US Data Privacy Framework. Stripe Privacy Policy
Resend: email delivery for account, certificate and enquiry emails. Resend Privacy Policy
Cloudflare: website hosting and content delivery network. Requests are served from Cloudflare's global network. Cloudflare Privacy Policy
Ordnance Survey: UK address lookup (OS Places) when you search for a property address. Ordnance Survey Privacy Policy
Anthropic: AI-assisted features, such as reading the data plate from a photo of a gas appliance. Only the photo you choose to submit is sent, and it is not used to train AI models. Anthropic Privacy Policy
Apple and web browser push services: delivering notifications, such as new test assignments, to devices where you have turned them on.

If you connect CertBase to another system, such as Simpro, ServiceM8 or Trade Desk, we exchange the relevant job, site and certificate data with that system on your instruction. That provider's own privacy policy applies to data held there.

4. Data retention

We retain your data for as long as your account is active. If you close your account, your data is deleted within 30 days, except where we are required by law to retain it (e.g. billing records, which we retain for 7 years).

5. Your rights

Under UK GDPR you have the right to:

Access: request a copy of the personal data we hold about you
Rectification: correct inaccurate data
Erasure: request deletion of your data ("right to be forgotten")
Portability: receive your data in a machine-readable format
Restriction: ask us to stop processing your data in certain circumstances
Objection: object to processing based on legitimate interests

To exercise any of these rights, email hello@certbase.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

6. Cookies

We use essential cookies and browser storage for authentication and session management. These are needed for the service to work and do not require consent.

We do not use advertising or analytics cookies, so no cookie consent banner is shown.

7. Security

All data is transmitted over HTTPS and encrypted at rest by our database provider. We never store your password in readable form. Our authentication provider keeps only a salted hash of it. Access to each organisation's data is enforced by row-level security in the database, and access to production data is restricted to authorised personnel only.

8. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email to account holders. The date at the top of this page always reflects the latest version.

9. Contact

For any privacy-related queries, contact us at hello@certbase.co.uk.

Privacy Policy